Security Issues with LastPass on Android

Post by throwaway24006 » Sat, May 29, 2021, 3:09 PM UTC

scrollaway wrote: post #22

Normal_gaussian wrote: post #5

Earlier quoted context omitted.

Thats right, we should blame the victim for trusting the tool. Password managers are increasingly mandated by organisations, and Lastpass is a very common recommendation. Even in the minority of technical users that use this kind of tool I expect small mistakes - like accidentally pasting a password in a URL. A good tool doesn't let you shoot yourself in the foot by escalting that to a non-obvious leak. The password…

There are only three meaningfully "correct" recommendations for password managers as of today, depending on the use case: 1Password, Bitwarden, or KeepassXC. 1Password is fantastic, but expensive and closed source. Bitwarden is open source, but lacks certain auditing, team and sync features useful for enterprise. KeepassXC is excellent and open source, but with zero collaboration features is only suitable for self us…

Post by throwaway24006 » Sat, May 29, 2021, 3:27 PM UTC

jfktn5ntkfl wrote: post #23

I'm more and more worried about a supply chain attack on LastPass/KeePass. To the point that I'm skittish about upgrading them. It feels to me like we need someone with huge resources, like Microsoft/Gooogle/Apple... to buy them and apply their methods against this attack. For example, where are the binaries built? Who controls the accounts used to upload the installers? Do they regularly pay security teams to try to…

Post by ufo » Sat, May 29, 2021, 3:33 PM UTC

umvi wrote: post #37

I use algorithmic passwords. I have an algorithm that takes in several parameters and generates a unique password per service. For example, my algorithm `f` might be: f(domain, secret_word, secret_sentence, rules) = UPPER(KEY_TO_RIGHT(domain[0:3])) + secret_word + secret_sentence[LENGTH(domain)] + LENGTH(domain) + PAD_TO_20("X") So if my secret word were "bottleneck" and my secret sentence were "It is a truth univers…

Post by umvi » Sat, May 29, 2021, 3:56 PM UTC

ufo wrote: post #45

umvi wrote: post #37

I use algorithmic passwords. I have an algorithm that takes in several parameters and generates a unique password per service. For example, my algorithm `f` might be: f(domain, secret_word, secret_sentence, rules) = UPPER(KEY_TO_RIGHT(domain[0:3])) + secret_word + secret_sentence[LENGTH(domain)] + LENGTH(domain) + PAD_TO_20("X") So if my secret word were "bottleneck" and my secret sentence were "It is a truth univers…

I'm not a big fan of the algorithmic password systems. In practice you need to remember some bits of state for each separate website, because of different password rules or because you had to reset the password. This results in either needing to memorize a lot of information or writing it all down somewhere. The former has the same problems as memorizing passwords without assistance. And if we need to write it down,…

Post by tialaramex » Sat, May 29, 2021, 4:39 PM UTC

throwaway24006 wrote: post #17

d7duhsebh wrote: post #9

Earlier quoted context omitted.

Most people realize they can hurt themselves if they use a hammer wrong. If someone can be expected to put four years of their life into a degree or prepatory trade training they can be held accountable for not caring enough to spend 10 minutes reading about effective use of their password manager.

That's not the reality though. The current wisdom in security seems to be to follow reality. To eliminate shooting foots by both users and developers. See NaCl crypto library, libsodium, Noise protocol, Signal app, Tarsnap and restic, Brian Warner's magic-wormhole, Signify/Minisign, Filippo Valsorda's 'age', WireGuard. Are there more?

  std::atomic n = 0;
  n++;

  let n = std::sync::atomic::AtomicU32::new(0);
  n.fetch_add(1, std::sync::atomic::Ordering::SeqCst);

  n += 1

  std::atomic n = 0;
  std::atomic m = 0;
  n++;
  m= m + n;

  use std::sync::atomic::{AtomicU32, Ordering};
  let n = AtomicU32::new(0);
  let m = AtomicU32::new(0);
  n.fetch_add(1, Ordering::SeqCst);
  m.fetch_add(n.load(Ordering::SeqCst), Ordering::SeqCst);

  use std::sync::atomic::{AtomicU32, Ordering};
  let n = AtomicU32::new(0);
  let m = AtomicU32::new(0);
  n.fetch_add(1, Ordering::SeqCst);
  m.store(m.load(Ordering::SeqCst) + n.load(Ordering::SeqCst), Ordering::SeqCst);